CVE-2025-48869: horilla · Improper Access Control
Affects horillaSource CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 08:30 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 37% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 24 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| horilla-opensource horilla | Affected
| Fixed in– |
AI-suggested
In the absence of an official patch, European organizations should implement immediate compensating controls to mitigate this vulnerability. First, restrict access to the directory storing uploaded resumes by configuring web server permissions to deny public access or require authentication. This can be achieved by using .htaccess rules (for Apache), equivalent configurations in Nginx, or access control lists at the filesystem level. Second, implement URL obfuscation or tokenization mechanisms to make file URLs unpredictable and valid only for authorized users. Third, consider moving sensitive files outside the web root directory and serving them through authenticated application endpoints that enforce access control checks. Fourth, monitor web server logs for suspicious access patterns indicative of URL guessing or scraping attempts. Fifth, conduct an internal audit of all publicly accessible directories to ensure no other sensitive data is exposed. Finally, plan for an upgrade or patch deployment as soon as the vendor releases a fix. Organizations should also review their data protection policies and incident response plans to prepare for potential data breach notifications under GDPR.
Description
Horilla is a free and open source Human Resource Management System (HRMS). Unauthenticated users can access uploaded resume files in Horilla 1.3.0 by directly guessing or predicting file URLs. These files are stored in a publicly accessible directory, allowing attackers to retrieve sensitive candidate information without authentication. At time of publication there is no known patch.